fix(audit): low-tier — session patient-gate + 201 statuses (L1, L11) + triage

L1: PATCH /session now enforces the patient_records subscription gate like its
sibling endpoints (ownership was already checked; the feature gate was missing).
L11: POST /pre-registration and POST /representation/iban return 201 on create.

Remaining low-tier findings triaged and accepted without change (documented in
docs/audit-backlog.md): L8 is a false positive (FK auto-indexed), L6/L7/L9 are
marginal indexes, L4/L5 are small bounded N+1, L2/L3/L10/L12 are minor — none
with security/integrity impact.

Regression: tests/Audit/LowTierFixesTest (both fail without the fix).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/Auth/Controller/PreRegistrationController.php

@@ -70,7 +70,7 @@ class PreRegistrationController extends BaseController
         $this->em->persist($preReg);
         $this->em->flush();
 
-        return $this->success(['uuid' => $preReg->getUuid(), 'status' => $preReg->getStatus()]);
+        return $this->success(['uuid' => $preReg->getUuid(), 'status' => $preReg->getStatus()], 201);
     }
 
     #[Route('/api/v1/admin/pre-registrations', methods: ['GET'])]

src/Patient/Controller/PatientController.php

@@ -274,6 +274,7 @@ class PatientController extends BaseController
     public function updateSession(string $uuid, Request $request, #[CurrentUser] User $user): JsonResponse
     {
         [$entityType, $entityId] = $this->resolveEntity($user);
+        $this->assertPatientGate($entityType, $entityId);
 
         $session = $this->sessionRepo->findByUuid($uuid);
         if ($session === null || !$this->ownsRecord($session->getRecord(), $entityType, $entityId)) {

src/Representation/Controller/RepresentationActionController.php

@@ -172,7 +172,7 @@ class RepresentationActionController extends BaseController
         ]);
         $this->em->flush();
 
-        return $this->success(['data' => $this->repProfile($rep, $user)]);
+        return $this->success(['data' => $this->repProfile($rep, $user)], 201);
     }
 
     #[OA\Delete(